Skip to main content

Shlink CVE-2026-18736

| EUVDEUVD-2026-52427 MEDIUM
Server-Side Request Forgery (SSRF) (CWE-918)
2026-08-03 VulnCheck GHSA-c6g4-pfhg-gvmp
SSRF Shlink
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.0 MEDIUM

Network vector confirmed; PR:L because API key is required; S:C because the server pivots to internal systems outside its security scope; C:L for partial data disclosure only.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Aug 03, 2026 - 21:09 vuln.today

DescriptionCVE.org

Shlink contains a server-side request forgery vulnerability that allows authenticated API key holders to cause the server to issue arbitrary HTTP GET requests by supplying a crafted long URL during short URL creation with title auto-resolution enabled. Attackers can submit URLs pointing to public hosts that redirect to internal targets, including loopback addresses, link-local ranges, and cloud metadata endpoints such as 169.254.169.254, to exfiltrate internal service information via the HTML title element returned in the short URL creation response.

AnalysisAI

Server-side request forgery in Shlink allows authenticated API key holders to coerce the server into issuing arbitrary HTTP GET requests to internal network targets, including cloud metadata endpoints such as 169.254.169.254, by submitting crafted URLs during short URL creation when title auto-resolution is enabled. The server follows HTTP redirects from attacker-controlled public hosts to otherwise-inaccessible internal addresses, then returns fetched content via the HTML title element in the API response, enabling exfiltration of internal service data. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Obtain valid Shlink API key
Delivery
Host redirect server on public IP
Exploit
Submit crafted URL to short link creation API
Install
Server follows redirect to internal target (e.g., 169.254.169.254)
C2
Internal service response HTML title parsed
Execute
Title content returned in API response
Impact
Attacker reads exfiltrated data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Two specific conditions must both be true: (1) the attacker must possess a valid Shlink API key - CVSS PR:L confirms authentication is required and anonymous exploitation is not possible; (2) the title auto-resolution feature must be enabled in the Shlink instance configuration - the description explicitly states this precondition. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 5.3 (Medium) reflects the genuine constraints: AV:N indicates network reachability, PR:L confirms an API key is required, and the impact is bounded to partial confidentiality disclosure (VC:L, SC:L) with no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a valid Shlink API key sets up an HTTP server at a public address that returns a 302 redirect to http://169.254.169.254/latest/meta-data/iam/security-credentials/ when queried. They then call the Shlink short URL creation API with this public URL as the long URL target while title auto-resolution is active; the Shlink server fetches the URL, follows the redirect to the cloud metadata endpoint, parses the returned content as an HTML title, and returns it in the API JSON response body. …
Remediation No vendor-released patch or specific fixed version was identified in the available data at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Shlink

View all
CVE-2026-18737 HIGH
7.1 Aug 03

Blind SQL injection in Shlink's tag statistics REST endpoint allows any API key holder to extract sensitive data from th
CVE-2026-18738 MEDIUM
5.1 Aug 03

CSV formula injection in Shlink 5.0.0-5.1.5 enables unauthenticated remote attackers to embed DDE or WEBSERVICE spreadsh

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2023-48022 CRITICAL POC
9.8

Same technique SSRF

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2016-3718 MEDIUM POC
5.5
CVE-2026-15409 CRITICAL POC
10.0

Share

CVE-2026-18736 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy